The FBI has a new warning about a familiar scam: account takeover.
Cybercriminals are targeting personal and business accounts, as well as organizations, including nonprofits. According to the FBI, fraudsters use account takeover schemes to gain control of bank accounts, payroll systems and health savings accounts.
It’s a lucrative crime — the FBI’s Internet Crime Complaint Center has received more than 5,100 complaints totaling over $262 million this year alone.
Criminals often use social engineering tactics, posing as financial institutions to gain access to accounts.
“Account takeover resulting from the trusted partner or imposter scam is one of the fastest-growing cyber threats we’re seeing,” said Jeff Taylor, head of Commercial Fraud Forensics at Regions Bank. “It’s critical that businesses and individuals stay vigilant.”
Examples of ATO methods include:
- Credential theft: Manipulating account owners to provide login credentials. Criminals then use those credentials to access legitimate websites, reset passwords and change contact information.
- Phishing messages: Sending fraudulent texts, emails or calls claiming evidence of suspicious transactions. Victims are urged to click a phishing link to “verify” information.
- Impersonating financial institutions: Scammers claim fraudulent purchases have occurred and pressure victims to act quickly. Banks may contact customers about legitimate potential issues. If you’re unsure, call your branch directly using a verified number. Remember, Regions will not ask you for the combination of your user ID and password.
- Domain spoofing: Creating phishing websites that mimic legitimate ones to trick users into entering credentials.
- Search Engine Optimization poisoning: Purchasing ads to boost placement in search results, leading victims to fake websites.
FBI Tips to Stay Protected
- Limit what you share online or on social media. Even seemingly harmless details can help scammers guess passwords or security answers.
- Monitor your financial accounts regularly for missing deposits or unauthorized withdrawals, transfers or charges.
- Use complex passwords and enable two-factor or multi-factor authentication whenever possible. Never disable it. Also consider adding an additional approver or dual control for financial transactions.
- Bookmark official websites for online banking or financial institutions. Searching online could lead you to a spoofed domain.
- Stay alert for phishing attempts. Don’t trust unsolicited messages or caller ID. If you receive an unexpected call or message, hang up and contact your institution directly using a verified number.
“If you suspect you’ve been targeted, act immediately,” said Kimberly Reece, Financial Crimes Customer Advocacy Manager at Regions. “Quick action can prevent further damage and protect your accounts.”
If you believe you’re a victim of an account takeover, contact your bank or financial institution and report the incident with as many details as possible. File a complaint with the FBI at ic3.gov. Change any compromised credentials, and if you reuse passwords across accounts, update each one with a unique password.
Additional Resources from Regions.com
Related Articles from Doing More Today
The information presented is general in nature and should not be considered, legal, accounting or tax advice. Regions reminds its customers that they should be vigilant about fraud and security and that they are responsible for taking action to protect their computer systems. Fraud prevention requires a continuous review of your policies and practices, as the threat evolves daily. There is no guarantee that all fraudulent transactions will be prevented or that related financial losses will not occur. Visit regions.com/STOPFRAUD or speak with your Banker for further information on how you can help prevent fraud.